Malware found in official Ccleaner installers

[shukla44]

Yes, after reading this entire discussion i will still use ccleaner or crap cleaner (as said here) but i will NOT trust Piriform. I haven't in the past that is why i had disabled the network connection of ccleaner in Kaspersky.

Regards.

 

[Paul Lee]

I knew it. I thought ESET gave a false positive when I downloaded the installer (which I found strange) and I brushed it off.

 

[Faybert]

The certificate was issued by Symantec

Symantec is manipulated by the NSA, I think this is no secret, so I run away from American products.

 

[giulia]

hi
as i know it can attack the 64bit too
but is the inflected version to download?
i can't download from here https://malwr.com/analysis/Y2M0YTFhNGQwYWYzNDlmZTllN2I0ZGUyOGEyMzFiMjE/

i would like to test on a virtual machine 64bit
thanks

 

[ispx]

@giulia,

UPLOAD.EE - CCleaner_5.33.6162.rar - Download

 

[Venustus]

Also for all the builds of that particular version:
UPLOAD.EE - CCleaner_5.33.6162.rar - Download

 

[Marko :)]

hi
as i know it can attack the 64bit too
but is the inflected version to download?
i can't download from here https://malwr.com/analysis/Y2M0YTFhNGQwYWYzNDlmZTllN2I0ZGUyOGEyMzFiMjE/

i would like to test on a virtual machine 64bit
thanks

64-bit version of CCleaner is safe but it's recommended to update it anyway.

@giulia,

Uploadfiles.io - ccsetup531 (1).exe

CCleaner v5.33 is infected, not v5.31.

 

[giulia]

@giulia,

Uploadfiles.io - ccsetup531 (1).exe

hi
it's the wrong version

Also for all the builds of that particular version:
UPLOAD.EE - CCleaner_5.33.6162.rar - Download

hi
thanks it's the right version
i will test it

 

[giulia]

64-bit version of CCleaner is safe but it's recommended to update it anyway.

CCleaner v5.33 is infected, not v5.31.

hi , yes 5.33

64-bit version of CCleaner is safe

are so you sure?
test it under a virtual machine with w7 or 10 both 64bit
after we can talk , i'm testing right now , i will post results
thanks

 

[Marko :)]

hi , yes 5.33
are so you sure?
test it under a virtual machine with w7 or 10 both 64bit
after we can talk , i'm testing right now , i will post results
thanks

Well, everyone said that it's safe so I assume it's safe.

 

[ispx]

i'm testing right now , i will post results

gracias

 

[toto_10]

Can someone please tell me how I disable network connection for CCleaner. I'm using Kaspersky Internet Security 2018.

 

[Venustus]

Can someone please tell me how I disable network connection for CCleaner. I'm using Kaspersky Internet Security 2018.

Go into "application control" and Deny network access for CCleaner!

 

[dhul.karnain]

Hmm.Nothing is safe nowdays.Good is that avast uncovered the attacks and timely patched.

"Timely"?

The infected files were on their servers for a month! Imagine how many hundreds of thousands, if not millions, of downloads occurred during that time?
If the malware deployed a secondary payload, which it currently seems wasn't the case, an unprecedented malware infection might have happened.

 

[giulia]

source : CCleaner Malware Incident - What You Need to Know and How to Remove

all that floxif is doing, ccleaner has been doing all that since years :

Malwr - Malware Analysis by Cuckoo Sandbox

hi
many companies suggest to restore an image , the step by step https://www.bleepingcomputer.com/how-to/security/ccleaner-malware-incident-what-you-need-to-know-and-how-to-remove/ is really funny!

The infected files were on their servers for a month! Imagine how many hundreds of thousands, if not millions, of downloads occurred during that time?
If the malware deployed a secondary payload, which it currently seems wasn't the case, an unprecedented malware infection might have happened.

good point!
there are users that have taken it almost like a joke

 

[dhul.karnain]

I'm done with their products. Both CCleaner and Speccy were immediately removed from my systems.
What 3rd party scanner reliably detects the Floxif payload?

 

[NikolayfromRussia]

"Timely"?

The infected files were on their servers for a month! Imagine how many hundreds of thousands, if not millions, of downloads occurred during that time?

Honestly I am afraid to download any program now. It can also be infected like a Ccleaner. I am not joking.

 

[ispx]

hi
many companies suggest to restore an image , the step by step https://www.bleepingcomputer.com/how-to/security/ccleaner-malware-incident-what-you-need-to-know-and-how-to-remove/ is really funny!

i agree with you 100% but please elaborate why you think it is funny. i can't wait to know your views on it.

 

[509322]

I'm done with their products. Both CCleaner and Speccy were immediately removed from my systems.
What 3rd party scanner reliably detects the Floxif payload?

RogueKiller premium. It also looks like Kaspersky as screen shots of its detection were shown today.

 

[R2D2]

I'm done with their products. Both CCleaner and Speccy were immediately removed from my systems.
What 3rd party scanner reliably detects the Floxif payload?

Comments on the Talos Intelligence Group blog page suggest trying Immunet. Cisco's Talos Intelligence Group Blog: CCleanup: A Vast Number of Machines at Risk